Loading...
HomeMy WebLinkAboutAudit Reports - Public - Glendale City Court Revenue and Receivables Management Audit Report - 6/26/2020 June 26, 2020 Mayor Weiers and Members of Glendale City Council: Independent Internal Audit Program (IIAP) is pleased to present the audit report of Glendale City Court Revenue and Receivables Management. This audit began in February 2020 and concluded in May2020. The audit covered the period January 2019 through December 2019. During the audit engagement, we noted some strengths in City Court’s revenue management processes including proper accountability for revenue received as well as strong collaboration with between the Court and Arizona Supreme Court in the implementation of the Case Management System. We also identified four opportunities to improve the management of City Court’s revenue and receivables. These are highlighted in detail in the report. The report was reviewed and accepted by the Council-appointed Audit Committee at its June 18, 2020 meeting. We would like to thank the Court management and staff for their corporation and support during the audit. Should you have any questions regarding this report, please don’t hesitate to contact me at 623-930-2103 or via email at eogutu@glendaleaz.com Respectfully Submitted, Emmanuel Ogutu, CIA, CFE Internal Audit Program Manager Distribution: Kevin Phelps, City Manager Michael Bailey, City Attorney Rick St. John, Interim Deputy City Manager Chris Briggs, Police Chief Vicki Rios, Assistant City Manager Elizabeth Finn, Presiding Judge, Glendale City Court Jean Moreno, Director, Organizational Performance Lisette Camacho, Director, Budget and Finance Irene Avalos, Audit Committee Member Rusty Simmons, Audit Committee Member Glendale City Court Revenue and Receivables Management Audit Draft Report June 26, 2020 Independent Internal Audit Program . Independent Internal Audit Program City Court Revenue & Receivables Management 1 Table of Contents Executive Summary ........................................................................................................ 2 A. Introduction ............................................................................................................... 3 B. Background .............................................................................................................. 3 C. Objective ................................................................................................................... 4 D. Key Outcomes .......................................................................................................... 5 E. Audit Results and Recommendations ....................................................................... 5 E1. City Court Properly Accounted for Revenue ..................................................... 5 E2. Improvement needed in management of case records .................................... 5 E3. Improvement needed in Management of Citations received from Police Department ................................................................................................................. 7 E4. AJACS Information Systems Controls Need Improvement ........................... 12 E5. City Court’s Accounts Receivable and Delinquency Management Controls Need Improvement ................................................................................................... 14 F. Process Improvement Opportunities ....................................................................... 17 G. Audit Scope and Methodology ................................................................................ 17 H. Data Reliability ........................................................................................................ 19 Independent Internal Audit Program City Court Revenue & Receivables Management 2 Executive Summary As part of our FY 2020 Audit Plan approved by the City Council, we conducted an audit of Glendale City Court’s revenue and accounts receivable management. The audit was performed to evaluate the design and operating effectiveness of internal controls related to the Court’s revenue and receivables management processes, accuracy and completeness of revenue and receivable records, adequacy and effectiveness of information systems controls as well as compliance with laws, rules and regulations. The audit objectives, and results follow: Audit Objectives: 1) To determine whether revenue and receivables were accurately and completely recorded. 2) To determine whether policies and procedures regarding revenue and receivables management were adequate and whether they were complied with. 3) To determine whether internal controls over revenue and receivables management are adequate and effective to mitigate against associated risks. Audit Conclusions: The Procedures and testing performed indicate d that the City Court properly accounted for the revenues received during the period under review. The audit noted four areas that require improvement and two process improvement opportunities. The four areas are highlighted below: 1. High: Improvements are needed in the management of case records to ensure they are complete. Specifically, physical case files and electronic case logs should contain the same information. Additionally, any waivers on fees and costs should be properly documented in case records. 2. High: The City Court in collaboration with Police Department, should put in place measures to track, reconcile and periodically audit citations received from the Police Department, to ensure all Citations are properly accounted for. 3. Moderate: The Court management develop a process to ensure that credentials of users that no longer work of the City are promptly deactivated from the case management system in collaboration with Arizona Supreme Court’s Administrative Office of Courts (AOC). 4. Moderate: The Court Management should develop a process to enhance management of accounts receivables including generating aging schedules for delinquent citations and reconciling them against detailed case listings as well strengthening review of annual delinquency report for accuracy and completeness. Independent Internal Audit Program City Court Revenue & Receivables Management 3 A. Introduction Independent Internal Audit Program (IIAP) conducted an audit of the Glendale City Court’s revenue and receivables management. The audit was included as part of IIAP’s FY20 Annual Audit Plan. While Glendale City Court is not in the business of generating revenue, and the money paid to the court is as a result of legislatively determined sanctions imposed to deter specific violations and criminal behavior, justice would not be served if imposed fees and fines are not paid by defendants. This helps enhance the effective functioning of the justice system. In the period January to December 20191, the City Court’s revenue from fines and fees was $2.6 million. Additionally, statistics regarding the City Court’s performance for the calendar year 2019 are summarized in the table 1 below. Table 1: Summary of 2019 Glendale City Court Revenue and Case Fillings Month Jan- 19 Feb- 19 Mar- 19 Apr- 19 May- 19 Jun- 19 Jul- 19 Aug- 19 Sep- 19 Oct- 19 Nov- 19 Dec- 19 Total Revenue (in thousands) City 230 250 311 262 226 200 204 192 174 203 180 166 2,596 State 198 251 294 235 205 182 179 185 172 182 159 156 2,397 Total 428 500 605 496 431 382 382 377 346 384 339 322 4,993 Case Filings Civil Traffic 796 924 977 681 865 856 786 829 845 852 562 1,031 10,004 Criminal Traffic 69 96 100 77 93 79 80 74 57 72 51 91 939 Misdemeanors 299 279 345 305 352 338 310 381 307 355 239 306 3,816 Parking 318 244 285 290 419 235 233 265 243 277 184 136 3,129 Protective Orders Filed 185 171 207 222 222 185 199 216 238 208 193 160 2,406 Total Filings 1,667 1,714 1,914 1,575 1,951 1,693 1,608 1,765 1,690 1,764 1,229 1,724 20,294 Source: Glendale Court Monthly Executive Summary Reports B. Background Glendale City Court adjudicates criminal misdemeanors, city code violations, traffic violations, and certain juvenile offenses committed in the city of Glendale. In cases of domestic violence and harassment, the Court issues protective orders. The Court has the authority to issue search warrants for misdemeanors and felonies. Glendale City Court collaborates with numerous internal and external justice and community agencies to 1 This is the period that IIAP focused on and formed part of the audit scope. Independent Internal Audit Program City Court Revenue & Receivables Management 4 develop and implement programs to reduce recidivism and promote safe communities. Nearly 100,000 customers enter the Court each year to conduct business2. The Court has established and implemented policies, procedures and controls that have continued to strengthen the effectiveness of the Court’s systems and processes. For instance, the Court has taken a leading role in partnering with the Supreme Court IT team since August of 2017 when the Arizona Judicial Automated Case System (AJACS)3 was first implemented by the Court. Specifically, the Court is the only Court in the entire state that has put together a bi-weekly conference call with the Supreme Court IT team to further enhance the AJACS system by proactively identifying bugs, errors and glitches in the system and working collaboratively to fix them promptly. Through this effort, the Supreme Court has identified Glendale City Court as a partner in this process of developing and testing programs prior to live release. This has benefited all Courts within the state that use AJACS as their core case management system. Court Management has also developed the Courtroom Helper and Courtroom Library, two great tools that help leverage AJACS. For instance, using these two tools, the Court has created 26 additional reports to help with case processing, audits, queues, performance management, quality assurance a nd governance. This audit focused on controls related to the fines, fees and collection functions of the Court as well as review the accuracy and completeness of revenues and receivables. Additionally, the audit included review of controls related to filing and reviewing cases, plea acceptance, collecting fees, processing indigent applications, payment plans, as well as default management and information systems controls. The Court operates and uses AJACS as its core system for management and processing of all cases. The Court has continued to improve on its systems and processes by among other things, partnering with the Supreme Court to help in designing and implementing such systems and processes. While The Court has continued to face various challenges with the deployment and usage of the AJACS system ., the Court has for instance continued to schedule regular conference calls with the Supreme Court to review issues with the AJACS system and work on a process to resolve such issues to ensure effective management of the justice process at the City Court. C. Objective IIAP conducted this audit to address the following objectives: 1) To determine whether revenue and receivables were accurately and completely recorded. 2) To determine whether policies and procedures regarding revenue and receivables management were adequate and whether these were complied with. 2 City Court webpage on City website 3 AJACS is managed and controlled by the Arizona Supreme Court’s Administrative Office of Courts (AOC). Independent Internal Audit Program City Court Revenue & Receivables Management 5 3) To determine whether internal controls over revenue and receivables management are adequate and effective to mitigate against associated risks. D. Key Outcomes This audit indicated that the policies, procedures and controls established by the court over revenue and receivable management are generally adequate and provide reasonable assurance on their effectiveness to mitigate the risk of loss and misstatement. However, there are additional opportunities to further strengthen and improve controls over revenue and receivable through ensuring completeness of case records, effective tracking of charging documents primarily citations, strengthening controls in the management of receivables as well as controls related to usage of information systems. E. Audit Results and Recommendations E1. City Court Properly Accounted for Revenue The City Court properly accounted for revenue for the period under review. For the cases we sampled, we tested and confirmed that all fine and fees assessed and received, were properly deposited into the City’s bank accounts as evidenced by deposit records . We also confirmed that all revenue fines and fees received agreed with the approved fee tables. Finally, we confirmed that all fines and fees received were properly recorded in the accounting records. However, we identified four improvement opportunities related to accuracy and completeness of records, tracking and reconciliation of charging instruments, management of cases in default, establishing and updating policies and procedures related to receivables management as well as periodic review and upda ting of user access controls within the case management system. These are discussed in findings E2 to E5 below. E2. Improvement needed in management of case records Condition: We selected a sample4 of cases and reviewed both electronic and manual records of the selected cases. Our review showed that, improvements are needed in the management of case records to ensure they are accurate and complete. Specifically, we observed the following: • In our sample of the 94 cases, 25 (27%) represented criminal cases. Of these, the physical case logs for 8 cases (32%) did not reconcile to the electronic logs. Specifically, the electronic logs showed incarceration costs having been either suspended or waived. However, these waivers were not documented in the phy sical case logs. See Appendix I for details. 4 Using a combination of random, stratified and monetary unit sampling (MUS) methodology, selected 94 cases for detailed review. Independent Internal Audit Program City Court Revenue & Receivables Management 6 • Of the 94 cases sampled, 12 (13%) represented delinquent cases due to the defendants’ failure to pay fines or fee assessed during sentencing. We performed detailed review of these cases to determine if the court had followed the process required when a case goes into default. When a case is in default, except for cases that are Court Assistant Program (CAP), the AJACS system is supposed to automatically generate default process after 30 days, calculate default fees, generate notices of default and send this to the Fines/Fees and Restitution Enforcement (FARE) program. We noted the system did not automatically generate the default notices in two (17%) of the 12 cases. The Clerk indicated that this was as a result of system glitch. This anomaly had been discovered by the Court in September of 2019 and reported to AOC. The AOC rectified the anomaly; however, it appears some cases were missed including the two in our sample. We note that the court has reached out to AOC to have this addressed. See Appendix I for details Criteria Arizona Revised Schedule (A.R.S.) Section 22-422 states “The magistrate shall keep a court record and shall enter each action and proceeding of the court in the court record”. Cause • The Court Clerks do not always check case files always to ensure fee waivers and suspensions are documented by the judges. • Due to system issues with AJACS, it appears the solution provided by the AOC did not correct all anomalies related to FARE notices. Also, a review by the court should have been done to determine if the correction of the anomaly addressed all cases. Effect Lack of a process to ensure consistent review of case records for accuracy and completeness, may result in instances where records can be accessed and changed, edited or even deleted either inadvertently or intentionally. Additionally, errors may go undetected. Recommendation 1) IIAP commends the Court Management for the bi-weekly audits it has in place since December 2018. This is a great control that helps detect and correct any issues that are identified in the sampled case files. However, audits mostly a corrective control helping to detect and correct errors and anomalies. In addition to this, IIAP recommends that Court Management have Court Clerks proactively and consistently review physical case files against electronic case records and if there are discrepancies resolve this with the judges in a timely manner. 2) We recommend that once AOC completes fixing system glitches, in the interim, someone should perform a review of the affected records to ensure that the fix has completely addressed the glitches reported. The Court can also create a report within Courtroom Helper to check the accuracy and completeness of fixes to Independent Internal Audit Program City Court Revenue & Receivables Management 7 systems glitches. In the long run, a script being worked on by the Court and partnership Supreme Court, AOC is expected to address this. Management’s Response: Management Agreement Owner Target Completion Date Concur Court Leadership Completed May 1st, 2020 Action Plan: On April 10th, 2020, the Presiding Judge sent an email to all Judges, Pro-Tems, the Court Administrator and Court Operations leadership staff on the importance of making sure that Jail Court fees are addressed by the Judge on the case file and entered correctly into the AJACS case management system. On May 1st, 2020 the Court created a “Jail Cost Monitor Queue” in Court Room Helper application that will determine cases to be pulled by Court Operations leadership to conduct review audits on Jail-Court fees to ensure that cases are addressed by the judiciary on the physical case file and entered correctly by Court Operations Clerks. Court Operations leadership runs this queue weekly to target any potential missing jail cost fees. Glendale City Court will continue to work with the Supreme Court AJACS development team on future scripts and bug fixes for the AJACS Case Management System. We currently meet bi-weekly with the AJACS development team and track all bug fixes set for future release. We also recommend and test schedule enhancements for the Supreme Court. E3. Improvement needed in Management of Citations received from Police Department Condition: To review accountability over charging instruments, we requested citation records from the Police Department (PD) and compared this with the citations recorded in AJACS. This analysis was to help us readily determine whether all valid citations were delivere d to the court and whether missing citations were voided, lost or did not constitute a charge.5 For the period under review, we noted discrepancies between citations in the PD records as compared to the Court’s database. For instance, in December 2019, with the help of the Court staff, we identified approximately 89 citations that were issued by PD and were either missing in the Court’s database or were not processed by the Court. This estimate to approximately 1,0686 citations per year, representing 7% of the 14,731 citations provided by the PD for the calendar year 2019. Of the 89, 33 represented warnings which typically do not constitute a charge. The remaining 56 included two duplicate citations, 5 PD issues citations for warnings. These are not sent to the City Court as they do not normally constitute a charge. 6 This is estimated based on an average of 92 citations per month. Independent Internal Audit Program City Court Revenue & Receivables Management 8 nine filed with different citation numbers7, two citations were converted to Long Forms8; 22 citations that had errors and were rejected by the Court. The remaining 21 represented criminal citations that the PD never filed with the City Court. We reviewed the procedure for retrieval of citations from the PD to the Court. The Court only processes what it receives from the PD and has a system that includes a daily tracking log of citations that is verified by both the Court and PD personnel at the Police Records Room. This log only includes citations received by the Court from PD and would not include any citations that the PD has not sent to the Court. As a result, such citations are completely not tracked. For the citations rejected by the Court, Court staff usually make a note on the tracking log and return such citations back to PD. It is not clear what happens to these rejected citations as no follow-up or reconciliation is performed between the tracking log and the database of citations issued to the Court by PD to ensure the reasons for the rejection are resolved and the citations sent back to the Court for processing. We reached out to PD to validate these citations not sent to the Court, and PD acknowledged the need to improve the citation management process on its part and indicated that a team has been constituted to review and resolve the discrepancies as PD moves to implement a new records management database9. Criteria: Per Arizona code §28-1560, “The appropriate fiscal officer of the governmental agency to which the traffic enforcement agency is responsible shall audit monthly the records of traffic citations required in this article. Audit procedures shall be sufficient to assure proper accountability for traffic citation records”. Cause: 1) There is no procedure to centrally and jointly reconcile the citations tracking log of against citations issued by PD. Such a reconciliation would help to proactively and timely address and resolve issues that caused their rejection. 2) For other citations including misfiled and missing citations, this is beyond the Court’s authority as the Court only processes what is received PD. It is the responsibility of PD to ensure that these are properly tracked, accounted for and properly send to the Court on a timely basis. This was not always the case as demonstrated by the December 2019 review performed with the help of City Court. Effect: 7 Original citation number is different from citation number listed in the case file. 8 Long Forms complaints are filed by the Prosecutor’s Office supplanting the citations created by PD. 9 IIAP notes that inclusion of the citation process was part of its scope to determine citation processing as it contributes to the City Court’s revenue management process. A full review and evaluation of Citations management process was not included as part of this audit and is therefore beyond the au dit scope. Independent Internal Audit Program City Court Revenue & Receivables Management 9 While IIAP acknowledges that the Court is only able to process citations received and that the Court has no administrative authority over PD, working collaboratively to resolve issues that cause rejection of citations by the Court may help reduce risks associated with management of these citations. Additionally, failure to track, account for and reconcile all citations at the PD exposes the citations management process to the risk of loss, theft or voiding either intentionally or inadvertently. This could result in instances in which civil and criminal violations may not be prosecuted due to loss of charging instruments thereby hampering criminal justice administration process. Recommendation: IIAP recommends the following: 1) PD in cooperation with the City Court, implement a procedure for centralized and joint reconciliation of the citations tracking log against citations issued to the Court by PD. Such reconciliation would at least help in addressing and resolving issues that result in the citations being rejected by the Court. 2) PD should conduct a review of all citations issued in the past to determine if these were fully accounted for. Such a review should also include a gap analysis to determine that all missing citations have a valid reason and are properly, accurately and fully accounted for. Finally, PD should comply with regulations by ensuring monthly audits of all citations. 3) As PD moves to implement the new records management system for e -citations, it should work collaboratively with the Court and other participants in t he criminal justice system during both development and implementation of the new system. Putting together a joint procedure that proactively and timely addresses issues that arise in the citations’ management process will be useful and increase effectiveness. Management Response: Court Management Agreement Owner Target Completion Date Court Management: Partially Concur Court Administrator/Glendale Chief of Police Police Motorola RMS Rollout, January of 2021 Action Plan: Do not Concur: The Court has had measures in place for more than a decade to track all manually received citations. Two Court personnel go to the main Police Station every weekday to secure citations. A log is created by the Police. Court Staff carefully review every citation to make sure it meets legal requirements such as date of birth, a signature etc. If a citation does not meet all mandatory criteria, per an agreement with Glendale Police, the Court lines through the incomplete citation and does not accept it. The log is signed, and a copy retained for Police and the Court. A reconciliation report was never created in the Hexagon police record management system for the Glendale Police or for the Court. The Court requested several times for Independent Internal Audit Program City Court Revenue & Receivables Management 10 Hexagon to build a reconciliation report that would match the e-citations in the Glendale Police records management system to those received by the Court’s AJACS case management system. Concur: On April 28th, 2020, the Court IT Business Analysts began working collaboratively with the Glendale Police Department, the Supreme Court AJACS development team, the Glendale City IT Department and Motorola (vendor) on the proper implementation of the e-citations platform. The goal of these biweekly meetings is to create a proper interface between the Glendale Police Department’s records management system (Motorola) with the Court’s case management system (AJACS). This e-citations platform would log, track and reconcile e-citations filed by the Glendale Police Department to the Glendale City Court. Within these collaborate meetings on the Motorola e -citations interface, Court personnel will continue to stress the importance of a joint reconciliation of the citations and an electronic tracking log against citations issued to the Court by the Glendale Police Department. The interface must be able to reconcile duplicate citations, fatal ticket errors, warning citations and tickets entered for the wrong jurisdiction by the Glendale Police Department as these are not to be filed with the Glendale City Court. The Court only counts what citations are properly filed by the Police Department. The Glendale Police e-citation platform completion date and the rollout the Motorola records management system is tentatively scheduled for January of 2021. The Court will continue its internal audit processes that were used to identify the issues previously mentioned above with the Hexagon police records management system. We will continue these audit measures until the Motorola platform is developed and launched by Glendale Police Department in early 2021. Management’s Response: Police Department Management Agreement Owner Target Completion Date Concur Police Chief Chris Briggs May 15, 2020 Action Plan: The City Auditor conducted a recent audit of the Glendale City Court and in a memo dated April 29, 2020, concluded that there is not a tracking mechanism on the Court side or the Police Department side to locate missing signed Criminal citations and ensure completeness and accuracy of all citations. In response to Recommendation #1: Independent Internal Audit Program City Court Revenue & Receivables Management 11 The Police Department concurs that centralized tracking of citations must occur. The Police Records system transmits all citations electronically to the Court via an interface with the Arizona Judicial Automated Case System (AJACS). As AJACS does not send an electronic response to the PD Records Management System, the Court should monitor their error queue to reconcile all electronic civil citations and notify the Police Department of any discrepancies so they may be investigated for errors and corrected. The Court should formally follow up with the Police Department in these cases where electronic submission errors are found, or a defendant shows up to Court with a copy of a citation that was never received in AJACS or by paper copy for a Criminal complaint. In response to this finding, effective May 15, 2020, the following procedure will be put into place for Police Department internal tracking of signed copies of Criminal citations. 1. Officers will submit Criminal citations into the designated Citations basket each day at each substation at the end of shift. 2. Each day, the Administrative Support Specialist or designee will locate these Citations and make an activity log entry into WebRMS of the type ‘Signed Cite Received’ which will then remove it from further Audit Reports. 3. A daily report has been created identifying all Citations where a physical copy is expected. Subscriptions are set up and the Lieutenants at Gateway and Foothills will be emailed the weekly report on Tuesdays and Fridays. Any citations that have not been received in the Citations basket and tracked into WebRMS will appear on the Audit report. 4. If a physical copy has not been tracked and appears on the audit report, the responsible Lieutenant will contact the issuing Officer and Sergeant to locate the Citation. 5. After being tracked into WebRMS, the Criminal Citations will be delivered to the Records inbox at main station. Records will continue to log all Criminal citations received each day before they are turned over to the City Court. 6. When the Citations are picked up the City Court at the Records window, the Court designee will sign for each Citation received. If the Citation is rejected by the City Court, Records personnel will follow up with the Officer for correction by sending an email to the Officer and his/her Sergeant and sending the citation back to the appropriate substation via interoffice mail. 7. An additional audit report will be emailed to Records Supervisors on the first of the month for the month prior documenting any remaining Criminal citations listed Independent Internal Audit Program City Court Revenue & Receivables Management 12 where the Activity Log Entry is missing. Records Supervisors will the follow up with the Officer by email, copying the Sergeant and Lieutenant for that area. 8. If a Criminal citation is to be voided, an Activity Log Entry of ‘Citation Voided’ will be entered by the Administrative Support Specialist or designee with the corresponding reason added to the Comments. Voided Citations will also be excluded from the ongoing audits as they are no longer expected, and the Police Department can audit voided citations using this field. Any Voided Criminal citation will then be submitted with the Citations to Records to be turned over to the City Court. In response to Recommendation #2: For the Police Department to review “all citations issued in the past,” the Police Department would need the Court to provide data on what was received versus what they expected to receive for the identified date range. With the new process outlined above in response to recommendation #1, the Police Department complies with internal monthly tracking of Criminal citations. In response to A.R.S. §28-1560, the Police Department is the “traffic enforcement agency,” not the “fiscal officer of the governmental agency.” The Police Department will cooperate with any audit handled by the City auditing authority and can provide to the auditor a monthly report of all citations issued that can be compared against the records from the Court. In response to Recommendation #3: The City Court is involved with the Citations interface for the new Police Records Management System and has been asked along with the AOC to provide interface documentation to Motorola. The City Court will be responsible to participate in testing for their side of the Citations interface. E4. AJACS Information Systems Controls Need Improvement We reviewed controls surrounding the processing of cases in AJACS as well as processing, and reporting of fines, fee, collections and receivables in both AJACS and the Tyler Munis system10. In our review, we noted one area that requires strengthening: Condition: User Access Management 10 Tyler Munis is the City of Glendale’s core financial system. All revenue, expenses, payables and receivables from and due to the City are recorded in this system. Independent Internal Audit Program City Court Revenue & Receivables Management 13 We compared the list of active AJACS users provided to us by Supreme Court AOC through Glendale Court Staff, with list of Court employees provided by City Human Resources Department. We identified 10 former Glendale Court employees who were in the user list but not in the list provided by HR. Upon further review and inquiry, we noted that eight of the 10 users had been separated from City employment with one having left employment more than two years ago. For the remaining two, one had retired from City employment and one declined the job on the eve of her starting date with the Court. We made inquiries of the Court staff about the process for removing users from the system as soon as they are separated from City employment. We were informed that the system analyst issues a ticket immediately to Supreme Court AOC once an employee is separated, requesting deletion of the employee’s profile from AJACS. Bases on records provided by Supreme Court AOC and Glendale Court, IIAP was not able to determine the if the Court submitted ticket for the removal of profiles for 3 of the 10 employees. Appendix II shows details. Criteria The City uses National Institute of Standards and Technology (NIST) framework for its information security processes. Section AC-5 of the NIST Special Publication (SP) 800- 53 (Revision 4) requires that an organization: (a) Separates organization-defined duties of individuals; (b) Documents separation of duties of individuals; and (c) Defines information system access authorization to support separation of duties. Section PS-4 requires that upon termination of individual employment, an organization should: (a) Disable information system access within a defined time period; (b) Revoke any credentials association with the individual. Cause Although the Court issues a ticket to AOC (remedy protocol) to disable users who have separated from City employment, no follow-up is done to ensure AOC has removed/disabled user credentials from the system. Effect This may lead either intentionally or inadvertently altering electronic records or files. could be performed by one individual, and individuals with superior roles could change system settings or data inadvertently or intentionally. Recommendation: We recommend Court Management to develop procedures to regularly review user credentials and working with AOC to ensure employees who are separated from City employment are disabled from the system timely. Additionally, such procedures should include regular tracking usage to ensure user logs match only active users. Independent Internal Audit Program City Court Revenue & Receivables Management 14 Management Response: Management Agreement Owner Target Completion Date Partially Concur Court Administrator/Court IT Business Analysts Completed Action Plan: Do not concur: It should be noted the Supreme Court, not Glendale City Court, is the entity who deletes employees no longer with the Court. To pose a danger, if somehow a person was not property deleted from the system, the person would have to break into the Courthouse and try to gain access to a Supreme Court computer. However, given any person who has not logged into the system for 30 days has their profile deleted, it would not be possible for a former employee to access a Supreme Co urt computer or the Supreme Court case management system. Concur: The Court will continue to use the remedy procedures established by the Supreme Court for all AJACS courts to disable users that are no longer with the Glendale City Court. The Supreme Court currently disables all user profiles that have not logged into the AJACS case management system or the network for 30 days. Should another 30 days pass, the user account is then deleted by the Supreme Court. Starting December of 2019, the Court will save all remedy email requests to the Supreme Court. Additionally, the Court will retain the confirmation of AJACS users disabled by the Supreme Court. Both documents will be saved electronically and by hard copy by the Court IT Business Analysts. They will be retained for a period of three years. As a final safeguard, the Court has established quarterly email reminders for the Court Administrator and the Court IT Business Analysts to request a report from the Supreme Court of all disable users within that period. E5. City Court’s Accounts Receivable and Delinquency Management Controls Need Improvement Condition The City Court recognizes a receivable at the time of sentencing. The Court had accumulated about $14.3 million in accounts receivables as of June 30, 2019, in fines court costs and fees that have become delinquent. Of this, the court estimates $13 million (89%) to be doubtful and projected only about $1.3 million in delinquent accounts as likely to be collected. As of January 31, 2020, the delinquent amount had increased to $14.5 Independent Internal Audit Program City Court Revenue & Receivables Management 15 million. The probability of collection is substantially reduced as 98% or about $14.26 million is over seven months old and has not been collected. While the City participates in several available methods to collect outstanding fines and fees including the Debt Set Off (DSO) program11 as well as the Court Assistance Program (CAP)12. The court has developed very robust and great tools to monitor, analyze and report collections of cases under CAP. These include CAP report that shows trend in the turnover of cases under CAP. The CAP program has proved effective with the court posting excellent collection rates compared to other courts. An analysis of Collections against total delinquent accounts is however not available in addition to analysis and monitoring of the CAP program. In 2019, $193,543 was intercepted by AOC on behalf of the Court as part of the effort to reduce delinquency. This represents about 1.3% of total amount owing. Additional issues we noted regarding receivables are: a) AJACS system lacks the capability to age accounts receivable by number of days due and to provide an analysis of receivables over a period of time. Specifically, it is not possible to extract outstanding amounts report for a specific historical date if that date has passed. The Point in time report generates only shows amount collected against assessed amount. Additional analysis that includes collection rate against total outstanding balance on a periodic basis would help to show how successful the Court is in managing overall delinquency. Outstanding balance report is only generated once a year. The latest report was prepared as of June 30, 2019 which was the end of the fiscal year when such a report is needed for the purpose of preparing City’s annual financial statement. b) Upon Inquiry from the Court management, IIAP team was informed that the annual receivable report is reviewed and approved by the Senior Accountant, Court Administrator and Presiding Judge before submission to City’s Finance Department. However, Court leadership does not initial the report to indicated that the review actually happened. There was also no evidence of additional review by Finance. As a result, IIAP is not able to provide reasonable assurance as to whether this report is reviewed. Criteria According to the principles of internal controls stipulated in C ommittee of Sponsoring Organizations internal control integrated framework13, a leading authority on effective internal control practices, an organization should develop control activities that through policies and procedures contribute to the mitigation of risks to acceptable levels. 11 DSO program was established to hold offenders accountable for financial obligations owed, to assist in the enforcement of court orders, and to increase collections in the Arizona court system. 12 CAP is designed to help you resolve past due traffic fines that are owed to the Court that may be preventing the reinstatement of your Arizona license. 13 COSO’s Internal Control—Integrated Framework (Framework) enables organizations to effectively and efficiently develop systems of internal control that adapt to changing business and operating environments, mitigate risks to acceptable levels, and support sound decision making and governance of the organization. Independent Internal Audit Program City Court Revenue & Receivables Management 16 Cause There exists an inherent weakness in AJACS receivable management specifically in generating an aged receivable report as well as a detailed listing of all receivables outstanding to support in periodic analysis, monitoring and oversight of receivables. Lack of evidence to indicate independent supervisory review of the annual receivables report. Effect There is a risk that receivable balances may not be accurate due to a lack of monthly reports on outstanding balances with detailed listings as well as failure to review the annual receivable report. Recommendation We recommend the Court Management to: 1) Using the Courtroom Helper tool, consider developing a monthly receivable outstanding aging report together with detailed listing that reconciles the report with the detailed listing to support already existing efforts in delinquency management. 2) Ensure annual receivables report is signed and approved by the Court Leadership by initialing the report prior to submission to City Finance Department. Management Response: Management Agreement Owner Target Completion Date Concur Court Leadership (Presiding Judge, Court Administrator, Senior Account) Reports Completed May 8th of 2020 Initial Annual Receivable Report Targeted for July 2020 Action Plan: On May 8th, 2020 Court Leadership deployed a “Receipted by Case Year” report as well as a “Receipted by Collection Method” report in Courtroom Helper. The goal of each report is to provide a detailed total of collections for aging and outstanding receivables. The reports show the total collected and the method collected for each year going back to 1998. The reports can also be run month to month. The reports are detailed in total amounts collected within a selected date range and can be displayed using a graph to show trends over time. The report also details which collection method is most effective in collecting the outstanding and aging receivables. Using these reports can also be used to better assess and forecast the collectability of aging receivables. In June of every year, the Senior Accountant meets with both the Court Administrator and Presiding Judge for a supervisory review of the annual receivables report. Court Leadership has never been instructed by the Supreme Court, the City of Glendale Independent Internal Audit Program City Court Revenue & Receivables Management 17 Finance Department nor in past external audits to initial annual receivables report prior to submission to the City Finance Department. In July of 2020, Court Leadership will meet with the Senior Accountant to review the annual receivables report. After that supervisory review meeting, Court leadership will initial and date the document prior to submitting to the City Finance Department. The Court will keep an electronic and hard copy of the initial and dated document. F. Process Improvement Opportunities IIAP identified opportunities for process improvements as a result of this review. The table below summarizes these recommendations. Table 2: Process Improvement opportunities Category Process Improvement Recommendations 1 Performance Metrics As part of the monthly/periodic performance reporting process, the Court should track and periodically report to City Management on the effectiveness of collection efforts using performance measures that are customarily used in the collections industry including: aging schedules of delinquent citations, collection rates and trends, collection per violation time, among others. 2 Collection Programs While AOC has several programs started to improve collection rates such as DSO and CAP, the Court should periodically assess the effectiveness of CAP program and issue a report with statistics on how this program has contributes to reduced delinquency and enhanced collection rates. G. Audit Scope and Methodology The audit scope covered the period January 1, 2019 through December 31, 2019. We conducted this audit from January 17, 2020 to February 29, 2020. The scope included examination of court records related to billing and collection of court fees and fines, review of physical and electronic case records, review and testing of accounts receivable, interviews with staff at the City, City’s Finance Department and PD as well as examination of controls over AJACS and Tyler Munis, the core information systems used for case management and for processing financial transactions respectively. We also reviewed laws regulations and procedures related to fines and fees as well as payment records, collection records and receivable reports prepared by Court staff. Independent Internal Audit Program City Court Revenue & Receivables Management 18 Our methodology included inquiry, observations, data analysis and tests of transactions and balances on selected sentenced cases14. We performed steps to obtain sufficient understanding of the revenue and receivables management process and reviewed internal controls over these processes to provide reasonable assurance that; (1) the controls over revenue and receivables management are adequate and effective; (2) the Court complied with rules and regulations related to revenue and receivables; and (3) revenue and receivables were properly accounted for. Our review of information systems included examination of general and application controls related to system access, user management, segregation of duties as well as accuracy of transactions related to fees and collection. We relied heavily on AJACS data files provided by the Court as well as AOC. To test fee related transactions, we randomly selected six months of 2019 and requested a listing of all cases sentenced in those six months. A total of 5,762 with an assessed amount of $2.7 million cases were sentenced. Using a combination of random, stratified and monetary unit sampling methodology, we selected and reviewed 94 (2%) of the cases with an assessed amount of $225,049 (8%) of total population amount. We performed statistical analysis and confirmed that the sample selected was representative of the population. Details of the sample selection are shown in the table below. Table 3: Sampling results Description No. of Items in the population Proportion Sample Size Amount Assessed at Sentencing Sampled Amount Proportion Sample/P opulation Items % Sample/Po pulation Amount % Misdemeanor - Non-Traffic 1,203 21% 20 $1,055,868 $142,977 64% 0% 14% Civil Traffic 3,155 55% 51 $1,111,685 $17,762 8% 1% 2% Local Ordinance 80 1% 1 $24,414 $253 0% 0% 1% Miscellaneous 40 1% 1 $3,014 $145 0% 0% 5% Parking 974 17% 16 $112,034 $1,433 1% 0% 1% Criminal Traffic 310 5% 5 $408,727 $62,480 28% 0% 15% Total 5,762 100% 94 $2,715,742 $225,049 100% 2% 8% We conducted this audit in accordance with Generally Accepted Government Auditing Standards as well as the professional standards for the practice of internal auditing. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. 14 Cases sentenced are moved on to disposition. Independent Internal Audit Program City Court Revenue & Receivables Management 19 H. Data Reliability The primary data utilized for the work performed in this audit was obtained dir ectly from the AJACS system. In determining whether the data used was reliable, we tested the following aspects of the data: 1) Consistency – We reviewed data entry practices at the Court and confirmed that data entry practices are sufficiently clear and well defined. For instance, data related to each case is entered by Court Clerks while payment related data are entered by Cashiers. Financials entries are performed by Accountants. This ensures results for multiple periods are consistent and comparable when analyzed. 2) Completeness – This refers to the extent to which relevant data records and fields are present and sufficiently populated. We examined electronic data related to cases and compared with third party records such as bank statements, accounting data and confirmed that case records were traceable to third party records. We also confirmed sequential numbering exists and are generally accounted for in some of the data parameters. 3) Accuracy – We reviewed financial related data in AJACS such as fee amounts allocation by violation type or fee categories and traced them to the City’s Accounting system and confirmed that such information generally reflected what was reported in the City’s accounting system. Through the testing work performed preliminarily following the above three criteria, we determined that the data is sufficiently reliable given its intended use. Independent Internal Audit Program City Court Revenue & Receivables Management 20 Appendix I Cases Records with Incomplete or Missing Information (See Finding E1) Case Number Complaint Number Waivers granted but not recorded in physical case logs Defaulted cases where system failed to generate notices M0747CM2019000556 C19000396 ✓ M0747CM2019018928 C19014021 ✓ M0747CM2019011830 C19009020 ✓ M0747CM2019001368 C19001026 ✓ M0747CM2019001461 C19001034 ✓ M0747CM2019005471 C19004019 ✓ ✓ M0747CM2019018370 C19013613 ✓ M0747CM2019006013 C19004642 ✓ M0747TR2019019039 C19014071 ✓ Independent Internal Audit Program City Court Revenue & Receivables Management 21 Appendix II 10 Users in AJACS User report who no longer work for the City (See Finding E3) Name Employment Status 1 Melanie Huante Retired in 2019 2 Mike Scheckle Retired in 3 Irene Rueda Separated on 9.21.2019 Independent Internal Audit Program City Court Revenue & Receivables Management 22 Appendix III Definitions of Audit Findings Rankings We assigned the risk rankings based on our professional judgment. A qualitative assessment of high, medium or low helps to prioritize implementation of corrective action as shown in the table below. High Critical control deficiencies that exposes the City to a high degree of combined risks. Recommendations from High risk findings should be implemented immediately (preferably within 3 months), to address areas with most significant impact or highest likelihood of loss, misappropriation or damage related to the City assets. Moderate Represents less than critical deficiencies that exposes the City to a moderate degree of combined risks. Recommendations arising from moderate risk findings should be implemented in a timely manner (preferably within 6 months), to address moderate risks and strengthen or enhance efficiency in internal controls on areas with moderate impact and likelihood of exposure. Low Represents low risk or control deficiencies and the exposure is not likely to expose the City and its assets to significant losses. However, they should be addressed in order to improve efficiency and effectiveness of operations. Recommendations arising from low risk findings should be implemented within 12 months.